Hacking Continues to Cause Majority of Reported Data Breaches

A recent study shows that reported data breaches in healthcare are more transparent than other industries, and that hacking is the leading cause across sectors.

Through June 2017 there has been a 29 percent increase from 2016 in US reported data breaches, according to a report from the Identity Theft Resource Center (ITRC) and CyberScout.

Overall, the number of breaches could hit a 37 percent annual increase over 2016, rising from 1,093 total breaches to 1,500, the study found.

In healthcare data breaches specifically, 81.5 percent of the data breaches reported to HHS included the number of records potentially affected by the incidents. That was equal to the first half of 2016.

Researchers noted that this is likely due to the HITECH Act requirements and HIPAA regulations, which mandate that healthcare organizations report on the number of affected records.

“We have made progress in transparency regarding data breach notifications but this only goes so far when we do not have complete information. The number of records breached in a specific incident allows us to provide more insight into the scope of this problem, and is a necessary next step in our advocacy efforts,” ITRC President and CEO Eva Velasquez said in a statement.

The business sector was once again the sector most likely to experience a data breach, accounting for 54.7 percent of the total breaches. Healthcare/medical came in second, with 22.6 percent of total data breaches occurring in that industry.

Sixty-three percent of all data breaches in the first half of 2017 were caused by hacking, which includes phishing, ransomware/malware and skimming. This was a 5 percent increase from the 2016 numbers.

Of the reported hacking attacks, 47.7 percent involved phishing. Nearly 19 percent of the hacking data breaches were from ransomware or malware incidents, the report found.

Employee error/negligence/improper disposal/loss was the second most common data breach cause, accounting for 9 percent of incidents. Accidental web/internet exposure made up 7 percent of reported data breaches.

CyberScout CEO Matt Cullina explained that hackers are looking to steal sensitive data and demand high payoffs, which often leads to devastating ransomware attacks.

“All these trends point to the need for businesses to take steps to manage their risk, prepare for common data breach scenarios, and get cyber insurance protection,” Cullina said in a statement.

Last year’s ITRC and CyberScout report had similar findings. For example, the business industry had a total of 494 reported data breaches, healthcare had 377, education tallied up 98 incidents, and government/military had 72 reported breaches.

Hacking, skimming, or phishing attacks were also the top data breach cause, accounting for 55.5 percent of the overall number of breaches. There is definitely a trend in this type of attack, as the 2016 numbers were a 17.7 percent increase from the 2015 findings.

CEO spear phishing attempts were also the most likely type of phishing attack, according to the 2016 report.

Healthcare data breaches can also be quite costly for organizations. The average cost of a data breach is $3.62 million globally, while healthcare data breaches cost organizations $380 per record, according to the 2017 Cost of a Data Breach Study: Global Overview from IBM Security and the Ponemon Institute.

Healthcare’s per capita was $380, followed by financial services ($336 per capita), services ($274), life science ($264), and industrial ($259). The mean per capita data breach costs were $225.

“Data breaches and the implications associated continue to be an unfortunate reality for today’s businesses,” Ponemon Institute Chairman and Founder Dr. Larry Ponemon said in a statement. “Year-over-year we see the tremendous cost burden that organizations face following a data breach.”

“Details from the report illustrate factors that impact the cost of a data breach, and as part of an organization’s overall security strategy, they should consider these factors as they determine overall security strategy and ongoing investments in technology and services.”